CA eTrust SiteMinder Developer's Guide for Java

Authorization ServicesSession TerminationA session is terminated in any of the following ways:■■■■After a user logs outs and the agent discards the session specificationWhen the session expiresWhen the session is revokedWhen the user account is disabledTo terminate a session, the agent must discard the session specification. Oncea session is terminated, the user must log in again to establish a new session.Authorization ServicesAgents that perform access control functions use the authorization services ofthe AgentAPI class. These services enable clients to verify a user’s rights toaccess a resource, retrieve a user’s privileges with respect to specificresources, and determine the specific access control, if any, that is imposedupon a resource.You can determine whether a resource is protected by calling the isProtected()method. This method accepts as a parameter the resource that is served bythe requesting agent and returns information about the user’s credentials.Once the user’s identity is validated, the agent calls the authorize() method todetermine if the requesting user has access to the requested resource. Agentscan perform fine-grained access control by leveraging the collection ofresponse attributes that this method retrieves.Auditing Services and Transaction TrackingAgents can keep track of and log all user activity during a session. Althoughmuch of a user’s activity is logged by the Policy Server, there are times whenit may be necessary to log authorizations done out of agent cache. Agents callthe audit() method to log such requests for resources.By generating a unique transaction id, agents can correlate access controlactivity with application activity. The transaction id can be given to both theauthorization and auditing methods so that the Policy Server would record thetransaction-specific id associated with the application activity. This can be usedfor non-repudiation.42 Developer's Guide for Java